Transferable Graph Backdoor Attack

Yang, Shuiqiao; Doan, Bao Gia; Montague, Paul; Vel, Olivier De; Abraham, Tamas; Camtepe, Seyit; Ranasinghe, Damith C.; Kanhere, Salil S.

doi:10.1145/3545948.3545976

Cited by 16 publications

(6 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Te backdoor dataset contains the poisoned data, and the clean dataset is composed of clean data without trigger embedding [12,13]. Te GNNs that train the backdoor dataset are called backdoor GNNs, and the clean GNNs are trained on the clean dataset [14]. Te output of backdoor GNNs has two characteristics: (1) the output on the clean data is similar to that of clean GNNs; (2) the output on the poisoned data is predefned by the adversary.…”

Section: Introductionmentioning

confidence: 99%

“…Most of the existing works [15,16] on backdoor attacks are in the area of image and text and few studies on graph backdoor attacks [14,[17][18][19]. However, GNNs are also vulnerable to backdoor attacks.…”

Section: Introductionmentioning

confidence: 99%

“…Xi et al [17] proposed a dynamically changing subgraph trigger (GTA), where GTA would tailor diferent triggers to poison the data based on the features of each graph. Yang et al [14] proposed a transferable graph backdoor attack (TRAP), which uses a gradient score matrix-based surrogate model to generate edge triggers. Te above backdoor attack models are mainly for the graph-level classifcation task, where GTA extends the node-level classifcation task, and the result shows that GTA does not perform well in the node-level classifcation task.…”

Section: Introductionmentioning

confidence: 99%

“…First, determining how do we choose triggers for the node-level classifcation task. Most of the previous works used subgraphs as triggers [14,18]. Te subgraph trigger is similar to the example popularized in image backdoor attacks.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Feature-Based Graph Backdoor Attack in the Node Classification Task

Chen

Zhao

et al. 2023

International Journal of Intelligent Systems

View full text Add to dashboard Cite

Graph neural networks (GNNs) have shown significant performance in various practical applications due to their strong learning capabilities. Backdoor attacks are a type of attack that can produce hidden attacks on machine learning models. GNNs take backdoor datasets as input to produce an adversary-specified output on poisoned data but perform normally on clean data, which can have grave implications for applications. Backdoor attacks are under-researched in the graph domain, and almost existing graph backdoor attacks focus on the graph-level classification task. To close this gap, we propose a novel graph backdoor attack that uses node features as triggers and does not need knowledge of the GNNs parameters. In the experiments, we find that feature triggers can destroy the feature spaces of the original datasets, resulting in GNNs inability to identify poisoned data and clean data well. An adaptive method is proposed to improve the performance of the backdoor model by adjusting the graph structure. We conducted extensive experiments to validate the effectiveness of our model on three benchmark datasets.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Feature-Based Graph Backdoor Attack in the Node Classification Task

Chen

Zhao

et al. 2023

International Journal of Intelligent Systems

View full text Add to dashboard Cite

show abstract

“…Graph Backdoor Attacks. Backdoor attacks on GNNs have received significant attention in recent years [25,36,37,38,33,39,34]. Regarding graph backdoor attacks, they can be classified into two types based on the employed trigger: universal graph backdoor attacks and adaptive backdoor attacks.…”

Section: Related Workmentioning

confidence: 99%

Exploring metadiscourse in university lectures in Hong Kong

Liu¹

View full text Add to dashboard Cite

Federated Graph Neural Network (FedGNN) has recently emerged as a rapidly growing research topic, as it integrates the strengths of graph neural networks and federated learning to enable advanced machine learning applications without direct access to sensitive data. Despite its advantages, the distributed nature of FedGNN introduces additional vulnerabilities, particularly backdoor attacks stemming from malicious participants. Although graph backdoor attacks have been explored, the compounded complexity introduced by the combination of GNNs and federated learning has hindered a comprehensive understanding of these attacks, as existing research lacks extensive benchmark coverage and in-depth analysis of critical factors. To address these limitations, we propose Bkd-FedGNN, a benchmark for backdoor attacks on FedGNN. Specifically, Bkd-FedGNN decomposes the graph backdoor attack into trigger generation and injection steps, and extending the attack to the node-level federated setting, resulting in a unified framework that covers both node-level and graph-level classification tasks. Moreover, we thoroughly investigate the impact of multiple critical factors in backdoor attacks on FedGNN. These factors are categorized into global-level and local-level factors, including data distribution, the number of malicious attackers, attack time, overlapping rate, trigger size, trigger type, trigger position, and poisoning rate. Finally, we conduct comprehensive evaluations on 13 benchmark datasets and 13 critical factors, comprising 1,725 experimental configurations for node-level and graphlevel tasks from six domains. These experiments encompass over 8,000 individual tests, allowing us to provide a thorough evaluation and insightful observations that advance our understanding of backdoor attacks on FedGNN. The Bkd-FedGNN benchmark is publicly available at https://github.com/usail-hkust/ BkdFedGCN.Preprint. Under review.

show abstract

Are Graph Neural Network Explainers Robust to Graph Noises?

Verma

Yang

et al. 2022

AI 2022: Advances in Artificial Intelligence

View full text Add to dashboard Cite

Transferable Graph Backdoor Attack

Cited by 16 publications

References 27 publications

Feature-Based Graph Backdoor Attack in the Node Classification Task

Feature-Based Graph Backdoor Attack in the Node Classification Task

Exploring metadiscourse in university lectures in Hong Kong

Are Graph Neural Network Explainers Robust to Graph Noises?

Contact Info

Product

Resources

About